f3aa2b23a67f4dbcce9fff7bb084e70127e3e0c4f2ab0f605487c570a7408960

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Target

6ea09dc024349dc98b36f4ace0dd0fbf.exe
Size

23KB
MD5

6ea09dc024349dc98b36f4ace0dd0fbf
SHA1

ee2d57531115ae5605a6e8390271b42045d51b43
SHA256

89decabc7d563a393d3b74831b6b1fffdbf44bfd8f039067b701c6042a497c3b
SHA512

4cca6589559e23d0d2febd5340bf10fe2439cf92fd2188fdeacaf203175ef2e3ec2af8270a59d9973519a4858b842a7ca6b045bda2ee8b6895f1f6392e2bc28b
SSDEEP

384:z1bbjWRHaxIBP10OfuBuF6Y+ELHWxIE/KgN0ULocmfY4eemHdd+Gx/anxiWk:z1yR6yHF6NDP/K6M8HflsnxA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2912	2820	6ea09dc024349dc98b36f4ace0dd0fbf.exe	30
PID 2820 wrote to memory of 2912	2820	6ea09dc024349dc98b36f4ace0dd0fbf.exe	30
PID 2820 wrote to memory of 2912	2820	6ea09dc024349dc98b36f4ace0dd0fbf.exe	30

C:\Users\Admin\AppData\Local\Temp\6ea09dc024349dc98b36f4ace0dd0fbf.exe
"C:\Users\Admin\AppData\Local\Temp\6ea09dc024349dc98b36f4ace0dd0fbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 452
  2⤵
  PID:2912

memory/2820-0-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

Filesize
4KB

Download
memory/2820-1-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2820-2-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2820-3-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2820-4-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2820-5-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

Filesize
4KB

Download
memory/2820-6-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2820-8-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2912-7-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download